Another simple unconditionally secure quantum bit commitment protocol — beating 

entanglement with entanglement* 
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It is shown how the evidence state space in quantum bit commitment may be made to depend on 
the bit value or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is 
perfectly concealing, but is also e-binding because the bit-value dependent evidence space prevents 
the committing party from cheating by means of a local transformation that is independent of the 
part of evidence state space that has never been in his possession. 



o 
o 

G 



m ■ 

> : 

m . 
■ 

in : 
o . 
m ■ 
O ■ 

^: 

9 L,: 
^— > ■ 

G ■ 

g : 
cr 



In the previous paper , we showed how quantum tele- 
portation may be used to perform unconditionally secure 
quantum bit commitment (US QBC) by preventing the 
committing party (Adam) from entangling the different 
commitment possibilities. In this paper, we will show 
that another simple US QBC protocol may be obtained 
by individuating the evidence state space via split en- 
tangled pairs, so that pefect concealing can be achieved, 
while Adam is faced with a bit-value dependent evidence 
space. This in turn ensures that Adam cannot cheat by 
means of a local transformation. The underlying idea can 
be explained as follows. In order to cheat successfully, 
Adam needs to know the total state including the part 
Babe always keeps that does not affect security. How- 
ever, Babe can classically randomize over that part and 
she cannot cheat by entangling over it. This interplay 
of classical and quantum randomness can be utilized to 
yield a simple US QBC protocol as follows. 

Let \kj)j, j € {//, i'}, kj € {1, 2}, be two openly known 
orthonormal qubit states, (1|2) = 0, for each of the two 
possible j. When there is no ambiguity, we would write 
\kj)j simply as \k)j to simplify notation. Let Babe pre- 
pare two states 



(i) 



where \k)j e Hf a , k E {1,2}, and {\f k )j\k = 1,2} form 
an orthonormal basis in H B S for each j € {/i,^}, with 



We have 
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skipped one subscript j in as in \k)j to simplify 



H B g on two qubits for each j. 
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notation. Let H B = 
H B = H B ®H B . 

Babe keeps H B and sends the ordered pair of qubits 
H B to Adam. Adam applies the followin transformation 



*NOTE: This paper is the second of three papers that together 
provide a detailed description of various gaps in the QBC "impos- 
sibility proof," as well as security proofs for four different protocols, 
QBC1, QBC2, QBC4, and QBC5. In this v3 on QBC4, the proto- 
col is modified to remove an ambiguity in v2 in a more transparent 
formulation. The appendix has been moved to the first paper. 
^Electronic address: yuen@ece.northwestern.edu 
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where i S {1,2,3,4}, {|e^)j} complete orthonormal in 
Hf, and Vi are four unitary qubit operators given by /, 
<7 X , —io~y, o~ z in terms of the Pauli spin operators when |1) 
and 1 2) lie on the qubit z-axis. Eq. (0) can be obtained 
by the unitary transformation J^i \ e i)( e i\ ® Vi on H. ® 
H B a with initial state \tpA) S H A that has (ei\ipA) = \- 
To commit b = 0, Adam sends back H B a ® H B a in the 
original order, and he switches them to H B a <8> H B a to 
commit b = 1. He opens by announcing b, the order of 
the two H B a he committed, and submitting the ordered 
qubit pair H A = H A <£> H A . Babe verifies by measuring 
the corresponding projections to |$ M )|<I>„) of (J2J). 

It is easy to verify by tracing over H A that for ei- 
ther b, p B = pf = I B /16 on H B , for any orthonormal 
{\fk)j}- H Babe entangles over the possible choices of 
such {\fk)j}, a simple calculation shows that perfect con- 
cealing p BC = p BC on H B (8 H c is maintained, where 
H c is the space Babe used to carry out such entangle- 
ment. This happens because the Vi operations by Adam 



totally disentangle the state on H B 



H B 



H into a 



that H B p 



be switched to H B g 



product state /„/4 ® p BC for either b, and there is no 
identity that individuates a qubit that is not entangled 
to another with both qubits in one's possession. 

Intuitively, we intend to guarantee binding by the fact 
3 in Babe's possession cannot 
'. B g by operating on H A <g> H B 
alone. However, this is possible if the two orthonormal 
sets {\fk)j} are known. Indeed, this is the content of the 
impossibility proof [2|. Thus, to guarantee security, Babe 
needs to employ different choices of {\fj} )j} with different 
bases indexed by n. She may employ a fixed probabil- 
ity distribution {p n j} for each j, and she may entangle 
these via orthonormal {Iff™);/}, ad infinitum. This possi- 
ble chain of purifications has to stop somewhere, and we 
simply stop it at H B without H . As we have seen, this 
does not affect perfect concealing so that Babe is free to 
choose any orthonormal {\fk)j}- It is clearly unreason- 
able for Adam to demand such knowledge, as codified in 
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the Secrecy Principle of Ref. [3j in our discussion of what 
we call Type 3 protocols. This possibility is neglected 
in the impossibility proof. In Ref. 0|, a proof was given 
that the knowledge of entanglement basis by Babe is not 
needed for Adam's cheating for a class of protocols that 
do not involve the switching of evidence state for commit- 
ment or the submission of part of an entangled state by 
Adam upon opening. It is these two features in combina- 
tion that guarantee the security of the present protocol. 
Further elaboration is given in connection with Type 3 
protocols in Ref. p|. 

To see exactly how binding is obtained in the present 
situation, note that the perfect cheating transformation 
U A is determiend by Eq. (18) of Ref. @, which is unique 
up to a phase factor in this nondegenerate situation. It 
depends on the unitary matrix Vkk' — n(fk\fk')v in the 
present case with state-space switching, in contrast to 
merely (fk\fk') = $kk'i he., no dependence on the ac- 
tual {|A)} m the case without switching. Thus, Adam 
cannot cheat perfectly. Note that we are indeed beating 
entanglement with entanglement: Babe's entanglement 
in the form Q is essential. She cannot maintain the pro- 
tocol security against Adam by just sending Tt^ a ® H^ a 
to Adam without first entangling to Tig. On the other 
hand, Adam's entanglement is not essential. As usual 
in QBC protocols, the whole procedure works the same 
if Adam chooses the Vl on Tt^ a and Tt^ a classically and 
opens by telling Babe his choice. 

We have assumed as usual that Adam opens b = 
perfectly. Let pa < 1 be Adam's optimum probability of 
cheating for a given choice of {\fk)j} and {p n j}, taking 
into account also all his other obvious imperfect cheat- 
ing possibilities, such as simply announcing a different b. 
We have thus shown that the formulation and the rea- 
soning of the impossibility proof break down already in 
this simple pair |<I>„) situation. 

When b = pefect opening condition is relaxed, it 
is clear that Adam still cannot cheat perfectly, but it is 
possible that the overall successful opening probability 
(honest plus cheating) may be improved. By continuity 
it can be seen that Adam's optimum cheating probability 
P A is arbitrarily close to pa = \ if the b = opening 
probability is arbitrarily close to 1, the case of interest. 

Protocol QBC4 is obtained when the above proto- 
col, to be called QBC4p, is extended to a sequence of 
{1*^)1*^)}, t e {1,.. -,N}, each of the form Q, with 
\fik)j G W£g, \ki)j e Hfjg, etc. Babe should send Adam 
{H^ a <g> H.f ua \ and Adam should commit to Babe these 
spaces for all \x after he entangles them with Ti.f^ (g> Hf v 
using the Vi operations, permuting each pair for b = 1. 
He opens by announcing b and the state of the qubits 
in each Hf a and submitting {Ttf}, with Babe verifyng 
\^tti)\^iv) & T~if ® Hf after possible rearrangement for 
each i. Since there is no new entanglement possibility for 
Adam, the protocol is perfectly concealing with P C A = p 1 ^ 



going to zero exponentially in N . Thus, QBC4 is per- 
fectly concealing and e-binding for any e > by letting 
N be large. 

So far we have assumed Babe is honest in sending 
Adam {Hf^Hf^} with states {|*^)|*^)}. However, 
she could cheat by sending in different states, e.g., un- 
cntangled states which are orthogonal for /j, and v. This 
kind of cheating is not accounted for in the impossibility 
proof formulation, which assumes the parties are honest 
during commitment, but can be handled in an ensemble 
formulation or a game-theoretic formulation as quantita- 
tively described in Appendices A and B of Ref. J.] . In this 
case, Adam checks |\I r Al )|\I r , / ) each time by asking Babe 
to send him Hg and check that the state in <8> Ha 
is of the form Q for some {\fk)j}- We summarize our 
perfectly concealing and e-binding protocol: 



This protocol belongs to what we call Type 4 proto- 
cols, in which split-entangled pairs are used to individu- 
ate state spaces Ti^ a and H^ a for verification, while they 
are indistinguishable to Babe before opening. In this way, 
both perfect concealing and e-binding can be obtained in 
a situation not covered by the impossibility proof. This 
protocol also utilizes the essential feature of a Type 3 
protocol, as discussed in Ref. ,5| . There we would also de- 
scribe another protocol QBC2, in which the switching of 
evidence state spaces is employed without split-entangled 
pairs, but only with a resulting e-concealing protocol. 
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PROTOCOL QBC4 

(i) Babe sends Adam TV ordered pairs {Tif^a ®T~lf va } 
of qubit pairs, I £ {1, . . . , TV}, which are entan- 
gled to {Tif^/j ®Ti.f V f3} in her possession in states 
Y$ ii±)V^ £v) of the form with independent ran- 
dom choices of {\fk)i} with probability {p n j}- 

(ii) To commit b, Adam applies, for each £, 
X) l e »)( e il ® ^» on %t ® Hf a , resulting in a 
state | $f M given via the form and sends 
{Ttf a } to Babe as evidence for b = 0, while 
switching the order ot each Ti.f )lot ^iTi.f jya for b — 1. 

(iii) Adam opens by announcing b, the order of the 
qubits in each Tif a , and submitting {Tif}. Babe 
verifies by projective measurements of {1$^}}, 
{!$£„)}, for all 1. 
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